Harden state integrity: Dry-Run rollback, profile import, batch apply (v1.121.11)

[TheAbider]

Fixes from an adversarial audit of the Dry-Run engine, configuration-profile import/export, and the batch (scripted) apply. Verified findings only; 1 finder finding was refuted and dropped.

Dry-Run (70-DryRun.ps1)

• Rolled-back atomic commit no longer silently drops changes (HIGH). After a mid-commit failure, Invoke-DryRunCommitAtomic correctly reverses the applied steps — but left them Status = "Applied", so a retry's Status -ne "Applied" filter skipped them (and the queue view rendered them green [A]). The reverted steps are now reset to Queued, so a retry re-applies them instead of reporting "all steps applied" with changes missing.

Config profile import / export (45-ConfigExport.ps1)

• Network apply can't strand a host with no IPv4 (HIGH). Both the profile-import network step and the drift-remediation IP fix removed the current address/route before adding the new one, with no rollback — a failed New-NetIPAddress (duplicate IP, off-subnet gateway) left the box with no IPv4 and no gateway. They now capture the prior IP + gateway and restore it on failure, then re-throw so the outer handler still logs it.
• Declining one step no longer aborts the whole import (MED). A bare return on the network-reconfig decline (and on an invalid domain name) skipped every remaining step and the summary. Now scoped to skip just that step.
• Export no longer fabricates a DNS server (MED). With no source DNS it wrote 8.8.8.8; it now leaves DNS null (like Hostname/IP/Gateway), and import skips DNS when null.
• Text export uses -ErrorAction Stop (LOW) so a truncated write isn't renamed into place and reported as success.

Batch apply (50-EntryPoint.ps1 + 14-WindowsUpdates.ps1)

• Shared-storage honors its boolean result (HIGH) — a refused/failed Initialize-StorageBackendBatch was counted as an applied change.
• Windows-Updates checks a status flag (MED) — Install-WindowsUpdates signals no-network/gallery/scan failure by return (not throw), so the batch was counting a failed run as applied. It now reads $script:LastWindowsUpdateStatus.
• Power-plan failure counts as an error, not a skip (LOW) (the summary/exit code derive success from $errors).
• DNS-only fast path registers an undo (LOW) so 'Undo all reversible changes' restores DNS.

Verification

• New Section 198 (14 asserts) + widened one distance-tight pre-existing remediation assertion.
• Structural 5332/5332; full Pester 312/312; PSSA 0. Monolithic rebuilt, parse check passed. Version → 1.121.11.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!